Threat actormedium

Multiple threat actors are targeting Elasticsearch Clusters

Security Affairsby @securityaffairsFeb 27, 2019 · 19:00 UTC (Feb 27, 2019)3 min read2 · 1 read

Read at securityaffairs.com

Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

CVEs: CVE-2014-3120 CVE-2015-1427 CVE-2018-7600 CVE-2017-10271 CVE-2018-1273

Tags: cve-2014-3120 cve-2015-1427 cve-2018-7600 cve-2017-10271 cve-2018-1273 threat-actor

Vulnerabilities mentioned

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2014-3120	Remote Code Execution via Dynamic Scripting in Elasticsearch (CVE-2014-3120)	—	89%	KEV	— KEV Mar 25, 2022
CVE-2015-1427	Sandbox Bypass RCE in Elasticsearch Groovy Scripting Engine	—	100%	KEV	— KEV Mar 25, 2022
CVE-2017-10271	Unauthenticated Remote Code Execution in Oracle WebLogic Server	7.5	100%	KEVRansomwarePoC ×3	Oct 19, 2017 KEV Feb 10, 2022
CVE-2018-1273	Unauthenticated RCE in VMware Tanzu Spring Data Commons	9.8	97%	KEVRansomware	Apr 11, 2018 KEV Mar 25, 2022
CVE-2018-7600	Unauthenticated Remote Code Execution in Drupal Core (Drupalgeddon 2)	9.8	100%	KEVRansomwarePoC ×4	Mar 29, 2018 KEV Nov 3, 2021

From the original article

3 min read at securityaffairs.com

Security researchers at Cisco Talos are warning of a spike in attacks on unsecured Elasticsearch clusters to drop cryptocurrency miners. Cisco Talos experts have reported a spike in the attacks that leverage known flaws to compromise unsecured Elasticsearch clusters and use them to mine crypto-currencies.

Security Affairs

By @securityaffairs · securityaffairs.com

Read the full article at Security Affairs

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.